{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2023-54201", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-30T12:06:44.499Z", "datePublished": "2025-12-30T12:09:06.211Z", "dateUpdated": "2026-08-05T09:17:59.823Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:17:59.823Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/efa: Fix wrong resources deallocation order\n\nWhen trying to destroy QP or CQ, we first decrease the refcount and\npotentially free memory regions allocated for the object and then\nrequest the device to destroy the object. If the device fails, the\nobject isn't fully destroyed so the user/IB core can try to destroy the\nobject again which will lead to underflow when trying to decrease an\nalready zeroed refcount.\n\nDeallocate resources in reverse order of allocating them to safely free\nthem." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Exploitation requires opening the local RDMA character device /dev/infiniband/uverbs0 and issuing uverbs ioctl/write commands (create QP, destroy QP); there is no remote or adjacent-network entry into efa_destroy_qp().\nAC:L - The attacker fully controls the double-destroy sequence, and once the EFA admin queue latches EFA_AQ_STATE_RUNNING_BIT off, every destroy_qp fails deterministically so the stale-pointer path is hit on every retry — including automatically during fd-close cleanup, requiring no race or special memory layout.\nPR:L - Any unprivileged local user who can open the uverbs device (installed mode 0666 by rdma-core udev rules, since EFA exists to serve unprivileged MPI/libfabric jobs) can allocate a ucontext, PD, CQ and QP and then destroy it; no capability is checked on the EFA QP create/destroy path.\nUI:N - The attacker performs every step from their own process — creating and destroying the QP — with no action needed from any other user or administrator.\nS:U - The use-after-free corrupts kernel slab memory within the same host kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The second rdma_user_mmap_entry_remove() dereferences a kfree'd struct efa_user_mmap_entry, reading entry->ucontext and start_pgoff/npages from reclaimed slab memory; with heap grooming this UAF gives an attacker-controlled read primitive into kernel memory.\nI:H - The stale entry is written to (driver_removed = true), its refcount is decremented on freed memory, and efa_mmap_free() kfree()s it a second time — a double-free/arbitrary-free plus controlled xarray erasure that is a well-known route to arbitrary write and control-flow hijack.\nA:H - Even without exploitation, the refcount underflow triggers a refcount_t WARN/splat and the double free corrupts the slab allocator, reliably producing a kernel oops or panic on the affected host." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/infiniband/hw/efa/efa_verbs.c" ], "versions": [ { "version": "ff6629f88c529b07d9704c656c64dae76910e3e9", "lessThan": "cf38960386f3cc4abf395e556af915e4babcafd2", "status": "affected", "versionType": "git" }, { "version": "ff6629f88c529b07d9704c656c64dae76910e3e9", "lessThan": "e79db2f51a564fd4daa3e508b987df5e81c34b20", "status": "affected", "versionType": "git" }, { "version": "ff6629f88c529b07d9704c656c64dae76910e3e9", "lessThan": "24f9884971f9b34915b67baacf7350a3f6f19ea4", "status": "affected", "versionType": "git" }, { "version": "ff6629f88c529b07d9704c656c64dae76910e3e9", "lessThan": "dc202c57e9a1423aed528e4b8dc949509cd32191", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/infiniband/hw/efa/efa_verbs.c" ], "versions": [ { "version": "5.7", "status": "affected" }, { "version": "0", "lessThan": "5.7", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.53", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.4.16", "lessThanOrEqual": "6.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.5.3", "lessThanOrEqual": "6.5.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.1.53" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.4.16" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.5.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.6" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/cf38960386f3cc4abf395e556af915e4babcafd2" }, { "url": "https://git.kernel.org/stable/c/e79db2f51a564fd4daa3e508b987df5e81c34b20" }, { "url": "https://git.kernel.org/stable/c/24f9884971f9b34915b67baacf7350a3f6f19ea4" }, { "url": "https://git.kernel.org/stable/c/dc202c57e9a1423aed528e4b8dc949509cd32191" } ], "title": "RDMA/efa: Fix wrong resources deallocation order", "x_generator": { "engine": "bippy-1.2.0" } } } }